Networked computers are used to transmit and fetch information to and from local sources (e.g., computers used in a business) and remote sources (e.g., enterprise services offered over the internet). To ensure privacy and security during communication between networked computers, authentication and verification mechanisms may be used. One such mechanism is a public key infrastructure system, in which networked devices use signed identity certificates for authentication and/or verification purposes.
In public key infrastructure systems, a certificate signing request (CSR) is a message sent from an applicant to a certificate authority in order to apply for a signed identity certificate. Before creating a CSR, the applicant first generates a key pair (including a public key and a private key), keeping the private key secret. The CSR contains information identifying the applicant (such as a distinguished name of the subject in the case of an X.509 certificate), and the public key generated by the applicant. The identifying information is commonly entered manually by a user. In conventional systems, the CSR is also accompanied by credentials or proofs of identity. Moreover, the certificate authority may contact the applicant for further information. If the request is successful (e.g., if the identifying information, credentials and proofs of identity are satisfactory), the certificate authority will send back an identity certificate (also known as a digital certificate, signed certificate, public key certificate, etc.) that has been digitally signed with the private key of the certificate authority. This identity certificate may thereafter be used by the applicant to authenticate and/or verify itself to networked devices that trust the certificate authority.